{"version":"1.0","provider_name":"WordPress &amp; BuddyPress Support Forums | BuddyDev","provider_url":"https:\/\/buddydev.com\/support","author_name":"Christopher Niedzwiecki","author_url":"https:\/\/buddydev.com\/support\/author\/khmi\/","title":"Maybe an exploit in Autologin after activation &#8226; WordPress &amp; BuddyPress Support Forums | BuddyDev","type":"rich","width":600,"height":338,"html":"<blockquote class=\"wp-embedded-content\" data-secret=\"jpCuBLSUQK\"><a href=\"https:\/\/buddydev.com\/support\/forums\/topic\/maybe-an-exploit-in-autologin-after-activation\/\">Maybe an exploit in Autologin after activation<\/a><\/blockquote><iframe sandbox=\"allow-scripts\" security=\"restricted\" src=\"https:\/\/buddydev.com\/support\/forums\/topic\/maybe-an-exploit-in-autologin-after-activation\/embed\/#?secret=jpCuBLSUQK\" width=\"600\" height=\"338\" title=\"&#8220;Maybe an exploit in Autologin after activation&#8221; &#8212; WordPress &amp; BuddyPress Support Forums | BuddyDev\" data-secret=\"jpCuBLSUQK\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\" class=\"wp-embedded-content\"><\/iframe><script type=\"text\/javascript\">\n\/* <![CDATA[ *\/\n\/*! This file is auto-generated *\/\n!function(d,l){\"use strict\";l.querySelector&&d.addEventListener&&\"undefined\"!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!\/[^a-zA-Z0-9]\/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll('iframe[data-secret=\"'+t.secret+'\"]'),o=l.querySelectorAll('blockquote[data-secret=\"'+t.secret+'\"]'),c=new RegExp(\"^https?:$\",\"i\"),i=0;i<o.length;i++)o[i].style.display=\"none\";for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute(\"style\"),\"height\"===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):\"link\"===t.message&&(r=new URL(s.getAttribute(\"src\")),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener(\"message\",d.wp.receiveEmbedMessage,!1),l.addEventListener(\"DOMContentLoaded\",function(){for(var e,t,s=l.querySelectorAll(\"iframe.wp-embedded-content\"),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute(\"data-secret\"))||(t=Math.random().toString(36).substring(2,12),e.src+=\"#?secret=\"+t,e.setAttribute(\"data-secret\",t)),e.contentWindow.postMessage({message:\"ready\",secret:t},\"*\")},!1)))}(window,document);\n\/* ]]> *\/\n<\/script>\n","description":"I had this plugin activated and manually activated a friends account with administrator account. It automatically logged me out of admin account and into his account. Not sure if this can be used to hack into profiles or be exploited by other users, but I thought I would mention it."}